CVE-2026-111038 is a CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platform. It occurs because user-controlled data in the Tenders module is not properly sanitized before being included in CSV files. An attacker with low privileges can craft input that spreadsheet applications interpret as formulas, potentially leading to unauthorized command execution or data access when the file is opened.